3CX 2023: A Supply-Chain Attack Built on Another Supply-Chain Attack
The 3CX compromise became a rare cascading supply-chain attack: a trojanized X_TRADER installer compromised an employee, then attackers used 3CX's own build environment to distribute malicious desktop software.
Customers first saw malicious behavior inside legitimately signed 3CX software
In March 2023, security companies began warning that versions of the 3CX DesktopApp for Windows and macOS had been trojanized. 3CX acknowledged that it had become the victim of an attack affecting its product and broader supply chain.[1] Because the malicious software arrived through a trusted vendor application and carried legitimate signing, customers faced the same problem seen in other supply-chain incidents: the mechanisms normally used to distinguish official software from tampering confirmed that the compromised release was official.
Trusted update channels multiplied the reach
The attacker did not need to send phishing attachments to every 3CX customer. Compromising the vendor’s production process let normal software distribution perform the delivery.
Mandiant later found that the initial 3CX intrusion began with another compromised software product
The most remarkable finding came in April. Mandiant’s investigation, published by 3CX, determined that an employee had installed Trading Technologies’ retired X_TRADER software on a personal computer. Although the installer came from a legitimate Trading Technologies site and was digitally signed, it contained VEILEDSIGNAL malware.[2] The attackers used that first supply-chain compromise to gain persistence on the employee machine and ultimately obtain 3CX corporate access. The 3CX attack was therefore downstream of an earlier software-supply-chain attack.
A trusted old installer remained dangerous after the product was retired
Software retirement does not automatically revoke old distribution channels, certificates, or user trust. Legacy installers need end-of-life controls because attackers can exploit the credibility of abandoned software.
Stolen corporate credentials helped bridge the personal and enterprise environments
3CX reported that the malware on the employee’s personal system enabled the threat actor to steal corporate credentials, after which the intrusion expanded into the company’s environment.[2] This was not simply a story about ‘personal devices are unsafe.’ The deeper problem was trust continuity: credentials usable for corporate access existed on a system compromised through unrelated third-party software. Strong device posture checks, phishing-resistant authentication, privilege separation, and conditional access can reduce how far one endpoint compromise travels.
Identity is part of the software supply chain
Once attackers possess valid enterprise credentials, later build and release actions can look like normal internal work. Supply-chain defense therefore spans code repositories, endpoints, identity systems, and build infrastructure.
Mandiant identified malware operating inside 3CX as investigators reconstructed the intrusion
3CX’s interim Mandiant report described malware used within targeted 3CX systems and attributed the activity to a tracked cluster with a North Korean nexus, while clearly labeling that conclusion as Mandiant’s assessment.[3] Attribution is separate from technical root cause. What engineers can verify directly is that the adversary established internal persistence and manipulated 3CX’s software-distribution chain. Historical treatment should preserve that difference rather than presenting intelligence assessment as an intrinsic property of the code.
Technical evidence and attribution answer different questions
Indicators, build modifications, and signed binaries explain how the compromise worked. Attribution addresses who was likely responsible and carries its own evidentiary limits.
CrowdStrike detected malicious activity in the 3CX DesktopApp ecosystem
CrowdStrike published detections and analysis of the compromised 3CX application, highlighting malicious behavior associated with legitimately signed software.[4] Early endpoint detections were important because vendor-side understanding was still developing. Supply-chain defense benefits from diverse observation: endpoint vendors, customers, network monitors, and the affected software company each see different parts of the incident.
SentinelOne detailed how the trojanized application staged follow-on behavior
SentinelOne’s analysis described the campaign it called SmoothOperator and documented the malicious components and loading chain embedded in compromised 3CX software.[5] The technique reinforced why code signing cannot be the final control. A valid signature can establish that the vendor’s key signed an artifact, yet the artifact may still be malicious if the build process was compromised before signing. Security products need behavioral evidence in addition to provenance.
The double compromise expanded the definition of supply-chain dependency
Organizations often model dependencies as libraries and packages listed in source manifests. The 3CX incident shows a broader graph: an employee workstation depended on an old trading application, corporate identity depended on that workstation remaining trustworthy, the build environment depended on corporate identity, and customers depended on the integrity of 3CX releases. None of those relationships appeared in one package lockfile. Supply-chain mapping must include tools, endpoints, identity, CI/CD, and vendor software.
Why 3CX 2023 belongs in software-failure history
The 3CX incident belongs in software history because it demonstrated supply-chain compromise as a cascade. A trojanized X_TRADER installer compromised an employee endpoint; that access helped attackers enter 3CX; the 3CX environment was then used to distribute malicious signed software to customers. Each stage borrowed trust from the previous one. The lasting lesson is that software supply chains are graphs of technical and human dependencies, not linear lists of libraries. Defense must break trust propagation between personal endpoints, enterprise identity, build systems, signing processes, and customer distribution channels.
Works Cited
- 01
- 02
- 033CX — Mandiant Initial Results 3cx.com
- 04
- 05SentinelOne — SmoothOperator: Trojanized 3CX Software sentinelone.com
CodeHistory is a living archive. Citations document the evidence used for this edition; later evidence may refine the account.